Back to Blog

Attackers Are Calling Your Employees to Steal Microsoft 365 Accounts. Your MFA Won’t Help.

Microsoft published a threat intelligence report last week on a campaign that’s been targeting Microsoft 365 accounts since May.[1] Two separate criminal groups have been calling employees on their personal phones, claiming to be IT help desk, and walking them through a sign-in process that hands over full account access. The campaign is ongoing. The method works. And the MFA configuration most small businesses are running right now doesn’t stop it.

The attack doesn’t start with a phishing email caught by a spam filter. It starts with a phone call.

An employee gets a call or text from someone claiming to be IT. They say there’s an urgent problem: the employee needs to update their passkey or multi-factor authentication settings to avoid an account lockout. A link arrives by SMS. The employee clicks it, lands on a page that looks exactly like Microsoft’s sign-in portal, and logs in normally. That’s where the damage is done.

Why MFA Doesn’t Stop This

The reason this defeats standard MFA is a technique called adversary-in-the-middle, or AiTM. The fake sign-in page isn’t just grabbing passwords. It’s relaying the login to Microsoft’s real servers in real time, and capturing the session token that gets issued after authentication succeeds.[1]

The session token is what actually proves you’re logged in. Not the password. Not the MFA code. The browser holds a token that says “this person authenticated” and Microsoft trusts it. Steal the token and you have persistent access. Your password and second factor are irrelevant to someone who already has the token.

Some variants of this attack skip the fake website entirely. The attacker guides the victim through a device-code authentication flow, a Microsoft feature designed for TVs and printers that don’t have keyboards. The victim enters a code on Microsoft’s real website, but in doing so they’re authorizing the attacker’s device to access their account.[1]

Who’s Behind It and What They Do With Access

Microsoft attributed the campaign to two groups. Storm-3121 passes stolen access to extortion crews operating under the names ShinyHunters and Falcon. Storm-3032 is made up of former BlackFile ransomware members, now operating as a group called Helix.[1]

Once inside an account, they don’t rush. First, they register their own authentication methods (a new phone number, an authenticator app) so they keep access even after the victim’s password changes. Then they use Microsoft Graph, a legitimate API built into every Microsoft 365 tenant, to quietly map the organization: users, groups, who has admin roles, what SharePoint sites exist, which mailboxes hold sensitive content.

Data collection is deliberate and slow. Microsoft’s report notes they access fewer than 1,000 files per hour to blend in with normal usage patterns.[1] SharePoint documents, OneDrive files, Exchange email and attachments. All of it, across multiple days, often without triggering a single alert.

There’s also a related campaign that ran for two days in early August: over one million CEO-impersonation emails sent through legitimate third-party delivery infrastructure, specifically to bypass email filters.[1] Different method, same goal.

Why Small Businesses Are More Exposed Here

Large organizations have IT help desks that employees can call back to verify. They have ticketing systems, known phone numbers, internal verification protocols. When a call comes in claiming to be IT, someone can check. Most small businesses don’t have any of that. An employee gets a call from “IT” and has nothing to cross-reference it against.

The other issue is how most small businesses have MFA configured. SMS codes and basic authenticator apps are both defeated by the AiTM method. The only approach that stops it is phishing-resistant MFA: hardware security keys (FIDO2) or Windows Hello for Business. These bind authentication to the specific website domain. A fake sign-in page on a different domain simply can’t complete the authentication handshake, even with a stolen password.[1]

Business email compromise (the broader category this falls into) cost businesses $3 billion in reported losses in 2025 alone, according to the FBI.[2] A growing portion of that involves phone-based social engineering rather than email. The shift makes sense from an attacker’s perspective: email filters have improved, employees have been trained on suspicious links, but a confident live phone call is a different thing entirely.

What to Actually Do

Move privileged accounts to phishing-resistant MFA first. Owners, admins, finance staff, anyone with access to sensitive data. FIDO2 hardware keys from Yubico run around $50 each. That’s a reasonable cost for what they block.

In Microsoft Entra ID (formerly Azure AD), configure conditional access to require a managed, compliant device for Microsoft 365 access. If an attacker’s unregistered device tries to use a stolen session token, it gets blocked before it touches anything.

Restrict security info registration. Right now, an attacker who steals a session token can immediately register their own MFA method and lock you out. Microsoft lets you limit who can register new authentication methods and from which conditions. Locking this down should be a priority this week.

Block device-code authentication flows in your tenant unless you have a specific device that requires them. Most small businesses don’t have printers or TVs authenticating to Microsoft 365. Disabling it removes the second attack path entirely.

Tell your employees, plainly: your IT provider will not call you out of nowhere and ask you to update your passkey. Any unexpected call or text about MFA or passkey configuration should be treated as suspicious until verified through a known contact number you look up yourself, not one provided in the call.